When generating headers for search, we unconditionally
access element 0 of an array, and I saw this segfault in our CI.
There's no reason we have to do this, we're just going through it
to get field names with reflect, so just make a new copy of the
struct in question.
Also, move this code, which is only for CLI display, into
cmd/podman from libpod/image.
Signed-off-by: Matthew Heon <mheon@redhat.com>
We'd need to join multiple container's user namespaces, which is
not possible for now. The rootless single userns patches under
development by Giuseppe will fix this, but won't land in 1.2.x.
For now, disable --size as rootless.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
the remote client now can run the diff command to report changes,
modifications, and deletions in an image or container.
Signed-off-by: baude <bbaude@redhat.com>
simplify the rootless implementation to use a single user namespace
for all the running containers.
This makes the rootless implementation behave more like root Podman,
where each container is created in the host environment.
There are multiple advantages to it: 1) much simpler implementation as
there is only one namespace to join. 2) we can join namespaces owned
by different containers. 3) commands like ps won't be limited to what
container they can access as previously we either had access to the
storage from a new namespace or access to /proc when running from the
host. 4) rootless varlink works. 5) there are only two ways to enter
in a namespace, either by creating a new one if no containers are
running or joining the existing one from any container.
Containers created by older Podman versions must be restarted.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
in the few places where we care about skipping the storage
initialization, we can simply use the process effective UID, instead
of relying on a global boolean flag.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
--trace, --help and --version were not capatilized like the rest of the
global options. This patch fixes this problem.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Currently in rootless containers, we end up not using the blob cache.
We also don't store the blob cache based on the users specified graph
storage. This change will cause the cache directory to be stored with
the rest of the containe images.
While doing this patch, I found that we had duplicated GetSystemContext in
two places in libpod. I cleaned this up.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Before, there were SELinux denials when a volume was bind-mounted by podman play kube.
Partially fix this by setting the default private label for mounts created by play kube (with DirectoryOrCreate)
For volumes mounted as Directory, the user will have to set their own SELinux permissions on the mount point
also remove left over debugging print statement
Signed-off-by: Peter Hunt <pehunt@redhat.com>
allows users to "watch" the output of podman ps on a set interval in
seconds. in watch mode, the screen is cleared between intervals as well.
podman -ps -w1 watches on 1 second intervals
Signed-off-by: baude <bbaude@redhat.com>
fix typo in Containers space usage: of podman system df -v, add a space for created time Change format string to const
Signed-off-by: Qi Wang <qiwan@redhat.com>
Add `digest` field to Image struct and update API.md
Show image digests when using --digests in podman-remote.
```
$ PODMAN_VARLINK_ADDRESS="tcp:127.0.0.1:1234" sudo bin/podman-remote images --digests
REPOSITORY TAG DIGEST IMAGE ID CREATED SIZE
docker.io/library/alpine latest sha256:d05ecd4520cab5d9e5d877595fb0532aadcd6c90f4bbc837bc11679f704c4c82 5cb3aa00f899 2 weeks ago 5.79 MB
docker.io/library/busybox latest sha256:4415a904b1aca178c2450fd54928ab362825e863c0ad5452fd020e92f7a6a47e d8233ab899d4 5 weeks ago 1.42 MB
```
Signed-off-by: Qi Wang <qiwan@redhat.com>
The jsoniterator library believes that panic() is a reasonable
response to being told to indent JSON with a tab. So use spaces
instead.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
We have a very high performance JSON library that doesn't need to
perform code generation. Let's use it instead of our questionably
performant, reflection-dependent deep copy library.
Most changes because some functions can now return errors.
Also converts cmd/podman to use jsoniter, instead of pkg/json,
for increased performance.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
fallback to the previous behavior of joining only the user namespace,
when we cannot join the conmon userns+mount namespaces.
Closes: https://github.com/containers/libpod/issues/2673
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
on the remote client, if a user wants to know the rootfs size of a
container, a -s should be passed. this corrects a behavior where size
was shown by default.
Fixes#2765
Signed-off-by: baude <bbaude@redhat.com>
We have a new event for container 'Exited' which has been renamed to
'died'.
also removed the stream bool from the varlink endpoint for events
because it can be determined by the varlink more value.
Signed-off-by: baude <bbaude@redhat.com>
podman will not start a transient service and timer for healthchecks.
this handles the tracking of the timing for health checks.
added the 'started' status which represents the time that a container is
in its start-period.
the systemd timing can be disabled with an env variable of
DISABLE_HC_SYSTEMD="true".
added filter for ps where --filter health=[starting, healthy, unhealthy]
can now be used.
Signed-off-by: baude <bbaude@redhat.com>
Inspired by #2684, I wrote a CI test to look for other such
instances in which a command is invoked without a required
argument. 'podman umount' seems to be the only one, and
solution is simple: checkAllAndLatest() already does the
check for us.
Resolve a few other problems uncovered by testing:
podman mount: indicate that CONTAINER arg is optional
podman pod stats: ditto
podman generate kube: remove check for -l (latest) flag,
it isn't actually implemented.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Minor fix to Use message: add IMAGE argument. (I'm a stickler
for this because my zsh completion is self-generating, from
the --help messages).
Also, sort 'tree' before 'trust' in man page.
Signed-off-by: Ed Santiago <santiago@redhat.com>
add the ability for users to specify more than one container at a time
while using podman logs. If more than one container is being displayed,
podman will also prepend a shortened container id of the container on
the log line.
also, enabled the podman-remote logs command during the refactoring of
the above ability.
fixes issue #2219
Signed-off-by: baude <bbaude@redhat.com>
Getting a list of containers, and then deleting them are two separate
fallible steps that can run into different sets of errors. eg., in the
case of a bogus missing container and a container that's running or
paused, the first step will only trigger libpod.ErrNoSuchCtr. At this
point it might appear that the exit code ought to be 1. However, when
attempting the deletion, it will fail once more due to the status of
the running or paused container. Since libpod.ErrNoSuchCtr is no longer
the only error encountered, the exit code should be reset to 125.
This problem is currently masked for rootless usage due to commit
35432ecaae ("rootless: fix rm when uid in the container != 0").
Fixes: 85db895012 ("rm: set exit code to 1 if a specified ...")
e41279b902 ("Change exit code to 1 on podman rm ...")
Signed-off-by: Debarshi Ray <rishi@fedoraproject.org>
...in order to silence Cobra's usually-helpful "(default xxx)"
message.
Initialization is now done in code, by testing for empty string
and setting that to /dev/std{in,out} as appropriate; make special
note of load.go where there's mild duplication between a local
variable and cliconfig.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Remove hardcoded '(default: true)' strings from bool flags,
and '(default this-or-that)' from string flags.
First because it's unmaintainable duplication that would cause
confusion should someone ever change the default and not notice
the message.
Second, because cobra[1] already prints '(default XXXX)' for
all options with non-false non-nil default. So in each of
these cases, current podman help behavior is:
$ podman login --help
...
--tls-verify Require HTTPS ... (default: true) (default true)
This PR eliminates that duplication.
[1] actually spf13/pflag/flag.go
The only nontrivial one of these is start.go, where the default
for sigProxy depends on the --attach flag. Solution: change
the command-line default to false, and implement the new
conditional default in logic. Bonus: removed unnecessary
check, because now if sigProxy is set without --attach,
we can guarantee that it was done by the user. But please
pay close scrutiny to this particular section in case
there's something I missed.
Signed-off-by: Ed Santiago <santiago@redhat.com>
we fire the cleanup process asynchronously so we might race with a
command like: podman run --rm --name foo ... && podman run --rm --name foo
Fix it by ensuring the container is deleted before we exit. This
will race with the "cleanup" process, but it is fine as one of the two
commands will fail with ErrNoSuchCtr while the other succeeds.
Closes: https://github.com/containers/libpod/issues/2619
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Also: enforce noSubArgs for podman events
Also: remove unnecessary '[flags]' from Use message (Cobra
adds it automatically)
Signed-off-by: Ed Santiago <santiago@redhat.com>
Make the usage messages (and options) different between
podman inspect, podman image inspect, and podman container inspect.
Disable inapplicable options (-l, -s) for podman image inspect
Disable -t (type) when the type is implicit through the subcommand.
Update man page to reflect differences in usage.
Fix broken test.
Uglier than desirable due to Go and Cobra limitations
Signed-off-by: Ed Santiago <santiago@redhat.com>
integration of healthcheck into create and run as well as inspect.
healthcheck enhancements are as follows:
* add the following options to create|run so that non-docker images can
define healthchecks at the container level.
* --healthcheck-command
* --healthcheck-retries
* --healthcheck-interval
* --healthcheck-start-period
* podman create|run --healthcheck-command=none disables healthcheck as
described by an image.
* the healthcheck itself and the healthcheck "history" can now be
observed in podman inspect
* added the wiring for healthcheck history which logs the health history
of the container, the current failed streak attempts, and log entries
for the last five attempts which themselves have start and stop times,
result, and a 500 character truncated (if needed) log of stderr/stdout.
The timings themselves are not implemented in this PR but will be in
future enablement (i.e. next).
Signed-off-by: baude <bbaude@redhat.com>
In lipod, we now log major events that occurr. These events
can be displayed using the `podman events` command. Each
event contains:
* Type (container, image, volume, pod...)
* Status (create, rm, stop, kill, ....)
* Timestamp in RFC3339Nano format
* Name (if applicable)
* Image (if applicable)
The format of the event and the varlink endpoint are to not
be considered stable until cockpit has done its enablement.
Signed-off-by: baude <bbaude@redhat.com>
to prepare for being able to remotely run a container, we need to
perform a refactor to get code out of main because it is not
reusable. the shared location is a good starting spot though
eventually some will likely end up in pkg/spec/ at some point.
Signed-off-by: baude <bbaude@redhat.com>
join the user namespace where the pod is running, so that we can both
manage the storage and correctly send the kill signal to a process
which is not running as root in the namespace.
Closes: https://github.com/containers/libpod/issues/2577
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
allow to configure the path to the network-cmd binary, either via an
option flag --network-cmd-path or through the libpod.conf
configuration file.
This is currently used to customize the path to the slirp4netns
binary.
Closes: https://github.com/containers/libpod/issues/2506
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
if an input YAML file lacks securitycontext and working dir for
a container, we need to be able to handle that. if no default for
working dir is provided, we use a default of "/".
fixes issue #2209
Signed-off-by: baude <bbaude@redhat.com>
When doing environment variable substitution, we need to make sure
$PWD is replaced with the current working directory.
fixes issue #2171
Signed-off-by: baude <bbaude@redhat.com>
Podman has no concept of a "restarting" container - such a
container is just transitioning from running to stopped and
then back to running through our ordinary state machine.
As such, filtering "restarting" containers doesn't work and does
nothing.
Also, make "stopped" containers show as exited - this is a
momentary state we transition to before proper exited.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Currently in podman if a user specifies a command that does not exist
the tool shows the help information. This patch changes it to show
information like:
$ ./bin/podman foobar
Error: unrecognized command 'podman foobar'
Try 'podman --help' for more information.
$ ./bin/podman volume foobar
Error: unrecognized command `podman volume foobar`
Try 'podman volume --help' for more information.
$ ./bin/podman container foobar
Error: unrecognized command `podman container foobar`
Try 'podman container --help' for more information.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
when we are creating a container that depends on another one, be sure
we also join its mount namespace in addition to the user namespace.
Closes: https://github.com/containers/libpod/issues/2556
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
it is not enough to join the user namespace where the container is
running. We also need to join the mount namespace so that we can
correctly look-up inside of the container rootfs. This is necessary
to lookup the mounted /etc/passwd file when --user is specified.
Closes: https://github.com/containers/libpod/issues/2566
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Add explicit [flags] to podman healthcheck run Use message.
Reason: Cobra checks for the string '[flags]' in the Use text.
If absent, and command has options, Cobra appends it. This
is misleading to humans, because the --help output looks like:
podman healthcheck run CONTAINER [flags]
...when of course that won't work.
Signed-off-by: Ed Santiago <santiago@redhat.com>
this is the final enablement for the pod subcommand. it includes the
ability to run podman-remote pod top and stats.
Signed-off-by: baude <bbaude@redhat.com>
Before, podman play kube ignored HostPath and VolumeMounts fields in a k8s yaml file. Add this functionality, allowing for a user to create a volume mount from a .yaml file
Signed-off-by: Peter Hunt <pehunt@redhat.com>
Add the ability to manually run a container's healthcheck command.
This is only the first phase of implementing the healthcheck.
Subsequent pull requests will deal with the exposing the results and
history of healthchecks as well as the scheduling.
Signed-off-by: baude <bbaude@redhat.com>
The current aliased commands
podman container list
and
podman image list
podman image rm
Do not work properly. The global storage options are broken.
This patch fixes this issue.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Clean up adapter code
* Add GetContainersByContext to Varlink API
* Add missing comments
* Restore save command
* Restore error type mapping when using varlink
Signed-off-by: Jhon Honce <jhonce@redhat.com>
In cases where a user issues the podman container runlabel
command and the image is not local, we now default to pulling
the image automatically to mimic the atomic cli behavior.
Fixes: BZ #1677905
Signed-off-by: baude <bbaude@redhat.com>
Found via:
for i in docs/*.md;do x=$(perl -ne 'if (/\[(podman-.*?)\(1\)\]\((podman-.*?)\.1\.md/) { print " $1 != $2\n" if $1 ne $2; print " ENOENT $2\n" unless -e "docs/$2.1.md" }' <$i); if [ -n "$x" ]; then echo $i; echo "$x";fi;done
...which is probably a good candidate for another CI hook,
except I have no idea how to rewrite it in awk.
Additionally, mark `podman refresh` and `podman container refresh`
as hidden, remove its man page, and remove references to it from
all other man pages.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Make more general-purpose: instead of hardcoding a list
of known subcommands, and duplicating sed pipelines for
each, rely on 'podman help' itself to tell us which
podman commands have subcommands; and examine each
in turn. Should there ever be new subcommands, this
will identify and test them.
A special case is needed for 'podman image trust', whose
documentation format doesn't match the others.
The change to `common.go` fixes an inconsistency: the
Usage message for commands with subcommands had an
unnecessary blank line, making it harder to parse
automatically. This simply produces consistent
Usage messages for all podman commands.
This script will not pass until #2480 is merged.
After that, the goal is to add this as a CI hook.
Signed-off-by: Ed Santiago <santiago@redhat.com>
pr #2480 fixed the missing 'podman image list/rm' commands;
it broke their usage messages. This corrects both usage
messages and also their examples.
Also: add an e2e test for 'podman image rm' (untested)
Signed-off-by: Ed Santiago <santiago@redhat.com>
Allow passing in of AttachStreams to libpod.Exec() for usage in podman healthcheck. An API caller can now specify different streams for stdout, stderr and stdin, or no streams at all.
Signed-off-by: Peter Hunt <pehunt@redhat.com>
* ps now on main command
* sign is no longer on main commmand
* ls, list no longer are valid main aliases for images
* ls, list does work for podman image
Signed-off-by: baude <bbaude@redhat.com>
list a portion of the container id and the ports exposed on the same
line. when using all, if no ports are exposed, do not list the container
id. Also, shorten the container id to a len of 12 like other container
commands.
Fixes bugzilla #1683734
Signed-off-by: baude <bbaude@redhat.com>
Several podman commands accept no subcommands. Some
of those were not actually checking, though, which
could lead to user confusion. Added validation where
missing; and, refactored to minimize duplication.
(Side note: I decided against using cobra.NoArgs
because its error message, "unknown command",
misleadingly implies that there are known ones).
Also added validation to varlink
Signed-off-by: Ed Santiago <santiago@redhat.com>
Also add some extra debug information to help figure out what's
going on when stop goes bad.
Fixes: #2472
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
With the change to cobra, the following command fails:
# podman create alpine sh -c /bin/true
Error: unknown shorthand flag: 'c' in -c
(Correct behavior is to pass '-c' to the container command)
This PR corrects that.
Signed-off-by: Ed Santiago <santiago@redhat.com>
* ps now on main command
* sign is no longer on main commmand
* ls, list no longer are valid main aliases for images
* ls, list does work for podman image
Signed-off-by: baude <bbaude@redhat.com>
The commands checkpoint and restore should only be available under
'podman container'. This is probably a result of the recent cobra
migration.
Signed-off-by: Adrian Reber <areber@redhat.com>
Conceptually simple: include, where applicable, a brief
description of command-line options for each subcommand.
Signed-off-by: Ed Santiago <santiago@redhat.com>
Instead of passing in defaults via WithStorageConfig after
computing them in cmd/podman/libpodruntime, do all defaults in
libpod itself.
This can alleviate ordering issues which caused settings in the
libpod config (most notably, volume path) to be ignored.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
when podman generate kube runs, it names the pod based on the first
container it finds. the resulting yaml file is perfectly acceptable
in a kubernetes environment. But when replaying the YAML file
with podman, we cannot have a container and pod with the same name.
therefore, we rename the pod if find a collision to name_pod.
Signed-off-by: baude <bbaude@redhat.com>
When removing volumes with rm --volumes we want to only remove
volumes that were created with the container. Volumes created
separately via 'podman volume create' should not be removed.
Also ensure that --rm implies volumes will be removed.
Fixes#2441
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
'podman logs -l' was no longer working. This fixes it by replacing
&waitCommand.Latest with &logsCommand.Latest.
Signed-off-by: Adrian Reber <areber@redhat.com>
when using the play kube command, we need to make sure that containers
with dependancies are started in proper order. in this case, the infra
container must be started first.
Signed-off-by: baude <bbaude@redhat.com>
We want named volumes to be created in a subdirectory of the
c/storage graph root, the same as the libpod root directory is
now. As such, we need to adjust its location when the graph root
changes location.
Also, make a change to how we set the default. There's no need to
explicitly set it every time we initialize via an option - that
might conflict with WithStorageConfig setting it based on graph
root changes. Instead, just initialize it in the default config
like our other settings.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Make it easy for scripts to determine if an image removal
failure. If only errors were no such image exit with 1
versus 125.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Make it easy for scripts to determine if a container removal
fails versus the container did not exist.
If only errors were no such container exit with 1 versus 125.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
kube was erronously being added as main subcommand multiple
times. it should not be a subcommand as it should live under
either play or generate.
also removing the addition of the volume command from the commands.go
to eliminate a duplicate.
Signed-off-by: baude <bbaude@redhat.com>
Switch defaults for --layers, --force-rm and --pull-always
from buildah to podman.
Only override default values.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This seems to be a needless restriction. We make a copy of the
hosts /etc/resolv.conf file, so these changes to not modify the
host.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Vendors in Buildah 1.7 into Podman.
Also the latest imagebuilder and changes for
`build --target`
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
in the case of the remote-client, it was decided to hide the latest
flag to avoid confusion for end-users on what the "last" container,
volume, or pod are.
Signed-off-by: baude <bbaude@redhat.com>
the remote-client is currently weak for carrying error messages
over the varlink interface and displaying something useful to users
and developers for the purposes of debug. this is a starting point
to improve that user experience.
Signed-off-by: baude <bbaude@redhat.com>
enable the remote client to be able to inspect a pod. also, bonus of
enabling the podman pod exists command which returns a 0 or 1 depending
on whether the given pod exists.
Signed-off-by: baude <bbaude@redhat.com>
The original intent behind the requirement was to ensure that, if
two SHM lock structs were open at the same time, we should not
make such a runtime available to the user, and should clean it up
instead.
It turns out that we don't even need to open a second SHM lock
struct - if we get an error mapping the first one due to a lock
count mismatch, we can just delete it, and it cleans itself up
when it errors. So there's no reason not to return a valid
runtime.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
This command allows for renumbering Podman locks after an upgrade
to Podman with SHM locks from a 1.0 or earlier branch, or after
the number of locks was changed.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Remove the duplicate kill command and only keep it in the
`mainCommands` containing commands that are implemented by
the native client and the remote one.
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
Also add some argument checks to the Varlink function to avoid
referencing nil pointers, and complement the API.md descriptions.
The varlink endpoint can be tested via varlink CLI:
$ varlink call -m unix:/run/podman/io.podman/io.podman.SearchImages \
'{"query": "ruby", "limit": 0, "tlsVerify": false, "filter": {}}'
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
Refactor the image-search logic from cmd/podman/search.go to
libpod/image/search.go and update podman-search and the Varlink API to
use it.
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
Spin up a goroutine for each registry to make podman-search run in
parallel. This has considerable speed improvements. For instance, a
`podman search ruby` drops from 11 to 2 seconds when using the following
search registries:
```toml
[registries.search]
registries = ['docker.io', 'registry.fedoraproject.org', 'quay.io',
'registry.access.redhat.com', 'registry.centos.org']
```
The number of parallel goroutines is limited to 6 to play nice with
local resources and the registries.
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
The fifth and final chunk of examples for the Cobra
examples in the CLI help output.
Also includes a few man page touchups.
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Adds the 4th chunk of Cobra Examples to the CLI help.
One more chunk of 10 to complete.
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
OpenShift Merge Robot
Sascha Grunert
Matthew Heon
Matthew Heon
baude
Giuseppe Scrivano
Daniel J Walsh
Valentin Rothberg
Peter Hunt
Qi Wang
Ed Santiago
Debarshi Ray
Kunal Kushwaha
Jhon Honce
Katerina Koukiou
Ed Santiago
Adrian Reber
TomSweeneyRedHat
Sebastian Jug